Skip to content

fix: handle tag@sha256:digest image refs in pull API#200

Draft
Jasperhino wants to merge 1 commit intocoast-guard:mainfrom
Jasperhino:fix/digest-image-ref-parsing
Draft

fix: handle tag@sha256:digest image refs in pull API#200
Jasperhino wants to merge 1 commit intocoast-guard:mainfrom
Jasperhino:fix/digest-image-ref-parsing

Conversation

@Jasperhino
Copy link
Copy Markdown

Summary

  • Fix image reference parsing in both coast-daemon and coast-service that truncated tag@sha256:digest refs at the colon inside sha256:..., producing invalid Docker pull requests (e.g., postgres:16.11-alpine3.23@sha256: with missing hash)
  • When an image ref contains @, the full reference is now passed as from_image with an empty tag, which the Docker API handles correctly
  • Adds 9 new tests covering the tag@sha256:digest format across coast-daemon, coast-service, and coast-docker

Context

coast build emits warnings when pre-caching images that use the tag@sha256:digest format in docker-compose.yml (e.g., postgres:16.11-alpine3.23@sha256:23e88eb...). The root cause is rfind(':') / rsplit_once(':') splitting on the wrong colon — the one inside sha256: — instead of the tag separator. This produces a truncated from_image and a bare hash as the tag in the Docker pull API call.

Images with just a tag (emqx/emqx:6.0.1) or just a name (atmoz/sftp) are unaffected.

Files changed

File Change
coast-daemon/src/handlers/build/utils.rs New parse_pull_image_ref() that handles @ before splitting on :
coast-service/src/handlers/build/images.rs Updated parse_image_ref() with same early @ check
coast-docker/src/image_cache.rs Tests only — this file already handled @ correctly

Test plan

  • All 182 existing tests pass (cargo test -p coast-docker -p coast-core -p coast-service)
  • New tests cover: digest-only (img@sha256:...), tag+digest (img:tag@sha256:...), registry+tag+digest (ghcr.io/org/app:v2.0@sha256:...), and registry-with-port (registry:5000/app:v1)
  • Verify coast build no longer warns for digest-pinned images in docker-compose.yml

Made with Cursor

The image reference parsers in both coast-daemon and coast-service used
rfind(':') to split image refs into (from_image, tag). For digest-pinned
refs like postgres:16.11-alpine3.23@sha256:23e88..., this splits at the
colon inside sha256:, producing a truncated from_image
(postgres:16.11-alpine3.23@sha256) and sending the bare hash as the tag.

Fix by detecting '@' in the reference first and passing the full ref as
from_image with an empty tag, which the Docker API handles correctly.

Adds tests for the tag@sha256:digest format in coast-daemon,
coast-service, and coast-docker.

Made-with: Cursor
@jamiesunderland
Copy link
Copy Markdown
Contributor

@Jasperhino do you have more to add to this or should I merge this?

@felipebn
Copy link
Copy Markdown

👋 Trying to use coasts and came across this issue too (filled #258). This fix would unblock our team. @Jasperhino would you mind if I rebase your branch and pick this up? Happy to keep your authorship via Co-Authored-By!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants